fyannk/pgadmin repository overview

⁠fyannk/pgadmin

pgAdmin 4 for restricted OpenShift and Kubernetes, with no privileged component left in the image.

The same pgAdmin release as the official image, without the capability a restricted platform refuses, so it runs as an unprivileged user or under whatever UID OpenShift assigns. The hardened variant goes further: rebuilt from pgAdmin's source with no setuid binary, no sudo and no mail server, and rebuilt again whenever Alpine or Python ship a fix. Every night both are scanned next to the official image; the security report⁠ shows the result, including whatever is still left.

⁠Why use it?

• Restricted-ready: no Linux capability and no root step, so it runs under OpenShift's restricted profile.
• Patched sooner: the hardened variant is rebuilt when a fix lands, and at least once a week.
• Two choices: latest for the hardened rebuild, <version> for the official image with only its capability removed.
• Proven, not promised: a public, nightly comparison with the official image.
• Signed: each image is signed as it is published, and comes with the list of what is inside it.

⁠Quick start

docker run -d --name pgadmin -p 8080:8080 \
  -e [email protected] \
  -e PGADMIN_DEFAULT_PASSWORD=change-me \
  fyannk/pgadmin:latest

It listens on 8080 rather than 80. Everything else documented for the official image⁠ works the same way.

⁠Tags

For linux/amd64. The images are also on GitHub Container Registry as ghcr.io/fyannk/pgadmin, with the same digests. All tags⁠.

⁠Learn more

• Security report⁠: the nightly comparison, variant by variant.
• What changes⁠ compared with the official image.
• Verifying a signature⁠.
• Source and issues⁠ on GitHub.

Apache-2.0; the images also contain pgAdmin, under the PostgreSQL Licence. See NOTICE⁠. PostgreSQL® and the Slonik logo are trademarks or registered trademarks of the PostgreSQL Community Association of Canada. This project is not affiliated with or endorsed by the Association, nor with the pgAdmin project.